Privacy Policy

1. Introduction

Attesso B.V. (“Attesso,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website attesso.com(the “Site”), use our platform, or interact with our services (collectively, the “Services”).

Attesso B.V. is registered in the Netherlands under Chamber of Commerce number 42040136. We act as a data controller for the personal data we process.

2. Data We Collect

We collect the following categories of personal data:

• Account information: When you sign up via our authentication provider (Clerk), we process your name, email address, and authentication credentials. Your password is never accessible to us.
• Organization information: Company name, team member details, and role assignments within your organization.
• Contact form submissions: Name, email address, company name, and any information you provide in your message, processed via Formspree.
• Transaction and payment data: When you use our payment authorization services, we process mandate details, spending limits, virtual card information, and transaction metadata. Payment processing is handled by Stripe; we do not store full credit card numbers.
• API usage data: API key usage, request metadata, IP addresses, and activity logs for security and billing purposes.
• Technical data: IP address, browser type, operating system, referring URLs, and device information collected automatically when you visit our Site.

3. How We Use Your Data

We use your personal data for the following purposes:

• Providing and maintaining our Services
• Authenticating your identity and securing your account
• Processing payment authorizations and managing spending mandates
• Communicating with you about your account and our Services
• Responding to your inquiries and support requests
• Detecting, preventing, and addressing fraud, abuse, and technical issues
• Complying with legal obligations, including PSD2 and GDPR
• Improving and developing our Services

4. Cookies

Our Site uses the following types of cookies:

• Essential cookies: Session and authentication cookies set by Clerk to keep you signed in and secure your account. These are strictly necessary for the functioning of our Services and cannot be disabled.
• Analytics cookies: Google Analytics 4 cookies (e.g. _ga) that help us understand how visitors use our Site. These are only set if you accept analytics cookies via our cookie banner.

We also use Vercel Web Analytics, which is cookieless and does not require your consent. We do not use advertising or retargeting cookies. You can manage analytics cookies at any time via Cookie Settings in the site footer. You can configure your browser to reject cookies, but this may impair the functionality of our Services.

5. How We Share Your Data

We share your data with the following service providers, each of which acts as a data processor on our behalf:

• Clerk, Inc. — User authentication and identity management.
• Stripe, Inc. — Payment processing and virtual card issuance.
• Formspree, Inc. — Contact form submission handling.
• Vercel, Inc. — Website hosting, infrastructure, and cookieless web analytics.
• Google LLC — Website usage analytics (Google Analytics 4), only when you accept analytics cookies.

We do not sell your personal data. We may disclose data when required by law or to protect our legal rights.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, or as required by law. Account data is retained while your account is active. Transaction records are retained for a minimum of 7 years to comply with Dutch financial record-keeping obligations. You may request deletion of your account at any time by contacting us.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. Our authentication system uses biometric verification (WebAuthn passkeys) where supported.

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — You may request a copy of the personal data we hold about you.
• Right to rectification — You may request that we correct inaccurate or incomplete data.
• Right to erasure — You may request deletion of your personal data, subject to legal retention requirements.
• Right to restrict processing — You may request that we limit how we process your data.
• Right to data portability — You may request a copy of your data in a structured, machine-readable format.
• Right to object — You may object to the processing of your personal data for certain purposes.
• Right to withdraw consent — Where we rely on your consent to process data, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@attesso.com. We will respond within one month. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

9. International Data Transfers

Our service providers may process data outside the European Economic Area (EEA), including in the United States. We ensure adequate protection for such transfers through Standard Contractual Clauses (SCCs) or other approved mechanisms as required by GDPR.

10. Children's Privacy

Our Services are not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through a notice on our Site. Continued use of our Services after changes take effect constitutes acceptance of the updated policy.

12. Contact

If you have questions about this Privacy Policy or our data practices, please contact us at: